Running Docker on Proxmox: LXC vs VMs and the Firewall Rules That Actually Matter

Short summary

A practical guide to running Docker on Proxmox, comparing LXC containers vs VMs based on isolation needs and resource constraints. The author recommends LXC for trusted workloads and VMs for untrusted input, with specific guidance on enabling nesting without going privileged. Firewall configuration at the datacenter level using security groups is recommended over per-container rules to prevent drift and exposure.

• •LXC for trusted workloads (near-native perf), VMs for untrusted input (stronger isolation)
• •Enable nesting + keyctl on unprivileged LXC instead of going privileged for Docker
• •Define datacenter-level firewall security groups rather than per-container rules

Generated with AI, which can make mistakes.